The default container already blocks the usual escapes: no capabilities, read-only root, non-root user, hard CPU and PID limits, and a path validator that refuses anything outside `/workspace`. Disabling the network stack goes further and leaves only loopback inside. The trade is real — with the network off the agent cannot install packages at runtime, so dependencies have to be baked into a custom image or already sitting in the mounted volume.
A Python MCP server running inside a locked-down container: non-root, all Linux capabilities dropped, read-only root filesystem, and hard CPU, memory and PID limits. The agent gets file and shell tools scoped to `/workspace`, the only directory mounted from your machine.
- Files read with `offset` and `limit`, written with syntax validation, listed with file and directory prefixes, and found by glob with exclusions — `read_file`, `write_file`, `list_directory`, `search_workspace`
- Shell commands run in `/workspace` under a mandatory timeout, with output compressed to cut token use — `run_bash`
- Multi-edit find-and-replace with fuzzy whitespace matching, indentation preservation, a dry-run mode and syntax validation for Python, JSON, JSONL, TOML and YAML — `search_and_replace`
- Guardrails on writes: existing files are not overwritten by default, and there is a 5MB size guard
Docker. Pull `ghcr.io/hrrodan/agent-workspace-mcp:latest` or build it with your own UID and GID, then have the client launch the container with your project directory mounted at `/workspace`. On Linux replace `1000:1000` with your real UID and GID — Claude Desktop does not expand environment variables — and keep `--init` so signals are forwarded. Environment variables tune it: `COMMAND_TIMEOUT` (default `60`), `MAX_SEARCH_RESULTS` (default `50`), `MAX_READ_SIZE_BYTES` (default `1048576`), `MAX_WRITE_SIZE_BYTES` (default `5242880`) and `LOG_LEVEL` (default `INFO`).
One command — docker pull ghcr.io/hrrodan/agent-workspace-mcp:latest